Black Hat Webcast on Hacking Appliances from NCC Group's Ben Williams

1. 2:53 PM
2:53 PM

2. 2:53 PM
2:53 PM

3. Proposition
• There is a temptation to think of Security Appliances as
impregnable fortresses, this is definitely a mistake.
• Security Appliance (noun) - Poorly configured and maintained
Linux system with insecure web-app (and other applications)
2:53 PM

4. Which kind of appliances exactly?
• Email/Web filtering
• Baracuda, Symantec, Trend Micro, Sophos, Proofpoint (F-
secure among others)
• Firewall, Gateway, Remote Access
• McAfee, Pfsense, Untangle, ClearOS, Citrix
• Others
• Network management, single sign-on, communications, file-
storage etc.
2:53 PM

5. Are these product well-used and trusted?
2013 SC Magazine US Awards Finalists - Reader Trust Awards -
“Best Email Security Solution”
• Barracuda Email Security
• McAfee Email Protection
• Proofpoint Enterprise Protection
• Symantec Messaging Gateway
• Websense Email Security Gateway Anywhere
2:53 PM

6. How are they deployed?
2:53 PM
Firewall
or Gateway
or UTM
Email
Filter
Web
Filter
Remote
Access
Security
Management
Other
Appliances

7. Sophos Email Appliance (v3.7.4.0)
• Easy password attacks
• Command-injection
• Privilege escalation
• Post exploitation
http://designermandan.com/project/crisis-charity/
2:53 PM

8. Easy password attacks…
2:53 PM
2:53 PM

9. Easy targeted password-attacks… because
• Known username (default, often fixed)
• Linux platform with a scalable and responsive webserver
• No account lockout, and brute-force protection
• Minimal password complexity
• Administrators choose passwords
• Few had logging/alerting
• Over an extended period, an attacker stands a good chance of gaining
administrative access
2:53 PM

10. Really obvious vulnerabilities
• Lots of issues
• XSS with session hijacking, CSRF, poor cookie and
password security, OS command injection…
• So… I got an evaluation…
2:53 PM

11. Oh dear… looks like fun for an
attacker
2:53 PM
2:53 PM

12. Command-injection (and root shell)
• Command-injection very common in appliances
• Why do I want a root shell?
• Foothold on internal network
• Reflective CSRF attacks (with reverse shells)
• Admins can’t view all email, but an attacker can
2:53 PM

13. Reflective attack
2:53 PM
Attacker

14. Reflective attack2
2:53 PM

15. What do you get on the OS?
• Old kernel
• Old packages
• Unnecessary packages
• Poor configurations
• Insecure proprietary apps
2:53 PM

16. Post Exploitation
• Stealing email or other traffic
• Plain-text passwords on box
• Steal credentials from end-users
• Adding tools and packages
• Attacking internal network
• Further exploit-development
• More bug-hunting, more 0-day
2:53 PM

17. Sophos fix info: Update (3.7.7.1)
• Reported Oct 2012
• Vendor responsive and helpful
• Fix released Jan 2013
• http://sea.sophos.com/docs/sea/release_notes/release_notes
.3.7.7.0.html
2:53 PM

18. Citrix Access Gateway (5.0.4)
• Multiple issues
• Potential unrestricted access to the internal network
2:53 PM

19. Hmm… That’s a bit odd…
ssh admin@192.168.233.55
2:53 PM

20. Where’s my hashes to crack?
2:53 PM

21. Port-forwarding (no password)
When SSH is enabled on the CAG - port-forwarding is allowed
ssh admin@192.168.1.55
ssh admin@192.168.1.55 -L xxxx:127.0.0.1:xxxx
2:53 PM

22. Port-forward Web UI
2:53 PM
2:53 PM

23. Potential access to internal systems!
Attacker
2:53 PM

24. Rather ironic: Remote Access Gateway
• Unauthenticated access to the internal network?
• Auth-bypass and root-shell
2:53 PM

25. Citrix fix info: Affects CAG 5.0.x
• Reported Oct 2012
• Fixed released last week (6th March 2013)
• CVE-2013-2263 Unauthorized Access to Network Resources
• http://support.citrix.com/article/ctx136623
2:53 PM

26. Symantec Email Appliance (9.5.x)
• Multiple issuesDescription NCC Rating
Out-of-band stored-XSS - delivered by email Critical
XSS (both reflective and stored) with session-hijacking High
Easy CSRF to add a backdoor-administrator (for example) High
SSH with backdoor user account + privilege escalation to root High
Ability for an authenticated attacker to modify the Web-application High
Arbitrary file download was possible with a crafted URL Medium
Unauthenticated detailed version disclosure Low
2:53 PM

27. Ownage by Email
2:53 PM

28. Out-of-band XSS and OSRF
• Chain together issues in various ways
• XSS in spam Email subject line, to attack the administrator
• Use faulty “backup/restore” feature (with OSRF) to add arbitrary
JSP to the admin UI, and a SUID binary
• XSS - Executes new function to send a reverse-shell back to
the attacker
2:53 PM

29. 2:53 PM
2:53 PM

30. XSS Email to reverse-shell as root
2:53 PM

31. Rather ironic
• Root-shell via malicious email message
• In an email filtering appliance?
2:53 PM

32. Symantec fix info: Upgrade to 10.x
• Reported April 2012 – Fixed Aug 2012
• CVE-2012-0307 XSS issues
• CVE-2012-0308 Cross-site Request Forgery CSRF
• CVE-2012-3579 SSH account with fixed password
• CVE-2012-3580 Web App modification as root
• CVE-2012-4347 Directory traversal (file download)
• CVE-2012-3581 Information disclosure
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se
curity_advisory&pvid=security_advisory&year=2012&suid=20120827_00
2:53 PM

33. Trend Email Appliance (8.2.0.x)
• Multiple issues
Description NCC Rating
Out-of-band stored-XSS in user-portal - delivered via email Critical
XSS (both reflective and stored) with session-hijacking High
Easy CSRF to add a backdoor-administrator (for example) High
Root shell via patch-upload feature (authenticated) High
Blind LDAP-injection in user-portal login-screen High
Directory traversal (authenticated) Medium
Unauthenticated access to AdminUI logs Low
Unauthenticated version disclosure Low
2:53 PM

34. Trend Fix info: Use workarounds
• Reported April 2012
• No fixes released or scheduled AFAIK
2:53 PM

35. Common exploit categories
• Almost all Security Appliance products had
• Easy password attacks
• XSS with either session-hijacking or password theft
• Unauthenticated information disclosure (exact version)
• The majority had
• CSRF of admin functions
• OS Command-injection
• Privilege escalation (either UI and OS)
2:53 PM

36. Common exploit categories
• Several had
• Stored out-of-band XSS and OSRF (for example in email)
• Direct authentication-bypass
• Other injections (SQLi, LDAP etc)
• A few had
• Denial-of-Service
• SSH misconfiguration
• A wide variety of more obscure issues
2:53 PM

37. Mitigations (Target Organisations)
2:53 PM
• Awareness is important
• Apply updates when available
• Be more demanding with product vendors
• ACL - “Defence-in-depth” and “least privilege”
• Management interfaces (Web-UI, SSH)
• Browsers, Management Jump-box
• Pen-test + implement recommendations

38. Thoughts
• Almost all Security Appliances tested were insecure
• Interesting state of play in 2012 – 2013
• Are you surprised?
• Variable responses from vendors
• Some fixed within 3 months, some not at all (or no information)
• What about Huawei?
2:53 PM

39. UK Offices
Manchester - Head Office
Cheltenham
Edinburgh
Leatherhead
London
Thame
North American Offices
San Francisco
Atlanta
New York
Seattle
Australian Offices
Sydney
European Offices
Amsterdam - Netherlands
Munich – Germany
Zurich - Switzerland
www.nccgroup.com
ben.williams ( at ) nccgroup.com
@insidetrust